9.8crit
CVE-2017-20166
Ecto missing `is_nil` requirement
Also known as GHSA-2xxx-fhc8-9qvq
Published 4 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known
Summary
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
1.32% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| hex | ecto | >=2.2.0, <2.2.1 | 2.2.1 |
Classification
- Weakness
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
- github.com /advisories/GHSA-2xxx-fhc8-9qvq · x_transferred
- github.com /elixir-ecto/ecto/pull/2125 · x_transferred
- github.com /elixir-ecto/ecto/commit/db55b0cba6525c24ebddc88ef9ae0c1c00620250 · x_transferred
- groups.google.com /forum/#%21topic/elixir-ecto/0m4NPfg_MMU · x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-20166 · advisory
- github.com /elixir-ecto/ecto · package
- groups.google.com /forum/#!topic/elixir-ecto/0m4NPfg_MMU · web
Sources
- CVE List: CVE-2017-20166
- GitHub Advisory: GHSA-2xxx-fhc8-9qvq
- NVD: CVE-2017-20166
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.